From 21ff524c690585048fce83e8e6236c1138d5d373 Mon Sep 17 00:00:00 2001 From: Ze-Zheng Wu Date: Mon, 7 Oct 2024 12:57:15 +0800 Subject: [PATCH] fix: DOM Clobbering CVE, similar to CVE-2024-47068 --- src/shell.js | 4 ++-- src/shell_minimal.js | 2 +- test/other/test_emsize.js | 28 +++++++++++----------------- test/other/test_emsize.out | 22 ++++++++++++---------- test/other/test_emsize.wasm | Bin 1781 -> 1286 bytes tools/link.py | 2 +- 6 files changed, 27 insertions(+), 31 deletions(-) mode change 100644 => 100755 test/other/test_emsize.wasm diff --git a/src/shell.js b/src/shell.js index b8c9f71854d2b..f760f752f9e50 100644 --- a/src/shell.js +++ b/src/shell.js @@ -175,7 +175,7 @@ var quit_ = (status, toThrow) => { #if SHARED_MEMORY && !MODULARIZE // In MODULARIZE mode _scriptName needs to be captured already at the very top of the page immediately when the page is parsed, so it is generated there // before the page load. In non-MODULARIZE modes generate it here. -var _scriptName = (typeof document != 'undefined') ? document.currentScript?.src : undefined; +var _scriptName = (typeof document != 'undefined' && document.currentScript?.tagName.toUpperCase() === 'SCRIPT') ? document.currentScript.src : undefined; #if ENVIRONMENT_MAY_BE_NODE if (ENVIRONMENT_IS_NODE) { @@ -375,7 +375,7 @@ if (ENVIRONMENT_IS_SHELL) { if (ENVIRONMENT_IS_WEB || ENVIRONMENT_IS_WORKER) { if (ENVIRONMENT_IS_WORKER) { // Check worker, not web, since window could be polyfilled scriptDirectory = self.location.href; - } else if (typeof document != 'undefined' && document.currentScript) { // web + } else if (typeof document != 'undefined' && document.currentScript?.tagName.toUpperCase() === 'SCRIPT') { // web scriptDirectory = document.currentScript.src; } #if MODULARIZE diff --git a/src/shell_minimal.js b/src/shell_minimal.js index 7567843242bf3..77225accec0a1 100644 --- a/src/shell_minimal.js +++ b/src/shell_minimal.js @@ -143,7 +143,7 @@ var ENVIRONMENT_IS_PTHREAD = ENVIRONMENT_IS_WORKER && self.name == 'em-pthread'; #if !MODULARIZE // In MODULARIZE mode _scriptName needs to be captured already at the very top of the page immediately when the page is parsed, so it is generated there // before the page load. In non-MODULARIZE modes generate it here. -var _scriptName = (typeof document != 'undefined') ? document.currentScript?.src : undefined; +var _scriptName = (typeof document != 'undefined' && document.currentScript?.tagName.toUpperCase() === 'SCRIPT') ? document.currentScript.src : undefined; #endif #if ENVIRONMENT_MAY_BE_NODE diff --git a/test/other/test_emsize.js b/test/other/test_emsize.js index 1b75ca386bcac..6cd4983135594 100644 --- a/test/other/test_emsize.js +++ b/test/other/test_emsize.js @@ -1,17 +1,11 @@ - -var a;a||(a=typeof Module !== 'undefined' ? Module : {});var k={},m;for(m in a)a.hasOwnProperty(m)&&(k[m]=a[m]);function p(b,c){throw c;}var q=!1,r=!1,t=!1,u=!1;q="object"===typeof window;r="function"===typeof importScripts;t="object"===typeof process&&"object"===typeof process.versions&&"string"===typeof process.versions.node;u=!q&&!t&&!r;var w="",y,z,A,B; -if(t)w=r?require("path").dirname(w)+"/":__dirname+"/",y=function(b,c){A||(A=require("fs"));B||(B=require("path"));b=B.normalize(b);return A.readFileSync(b,c?null:"utf8")},z=function(b){b=y(b,!0);b.buffer||(b=new Uint8Array(b));b.buffer||C("Assertion failed: undefined");return b},1>2],ja=M[c+(8*h+4)>>2],V=0;V=v);)++x;if(16g?v+=String.fromCharCode(g):(g-=65536,v+=String.fromCharCode(55296|g>>10,56320|g&1023))}}else v+=String.fromCharCode(g)}l=v}E(l);W.length=0}else W.push(E)}f+=ja}M[e>>2]=f;return 0},a:H}; -(function(){function b(f){console.log("receiveInstance");a.asm=f.exports;P--;a.monitorRunDependencies&&a.monitorRunDependencies(P);0==P&&(null!==Q&&(clearInterval(Q),Q=null),R&&(f=R,R=null,f()))}function c(f){b(f.instance)}function d(f){return na().then(function(h){return WebAssembly.instantiate(h,e)}).then(f,function(h){F("failed to asynchronously prepare wasm: "+h);C(h)})}var e={a:qa};P++;a.monitorRunDependencies&&a.monitorRunDependencies(P);if(a.instantiateWasm)try{return a.instantiateWasm(e,b)}catch(f){return F("Module.instantiateWasm callback failed with error: "+ -f),!1}(function(){if(G||"function"!==typeof WebAssembly.instantiateStreaming||ia()||S("file://")||"function"!==typeof fetch)return d(c);fetch(T,{credentials:"same-origin"}).then(function(f){return WebAssembly.instantiateStreaming(f,e).then(c,function(h){F("wasm streaming compile failed: "+h);F("falling back to ArrayBuffer instantiation");return d(c)})})})();return{}})();var pa=a.___wasm_call_ctors=function(){return(pa=a.___wasm_call_ctors=a.asm.e).apply(null,arguments)}; -a._main=function(){return(a._main=a.asm.f).apply(null,arguments)};a.___heap_base=5245632;var Y;function D(b){this.name="ExitStatus";this.message="Program terminated with exit("+b+")";this.status=b}R=function sa(){Y||Z();Y||(R=sa)}; -function Z(){function b(){if(!Y&&(Y=!0,a.calledRun=!0,!J)){U(da);U(ea);if(a.onRuntimeInitialized)a.onRuntimeInitialized();if(ta){var c=a._main;try{var d=c(0,0);if(!noExitRuntime||0!==d){if(!noExitRuntime){if(a.onExit)a.onExit(d);J=!0}p(d,new D(d))}}catch(e){e instanceof D||("unwind"==e?noExitRuntime=!0:((c=e)&&"object"===typeof e&&e.stack&&(c=[e,e.stack]),F("exception thrown: "+c),p(1,e)))}finally{}}if(a.postRun)for("function"==typeof a.postRun&&(a.postRun=[a.postRun]);a.postRun.length;)c=a.postRun.shift(), -fa.unshift(c);U(fa)}}if(!(0{throw b;},t="",u,v; +if(l){var fs=require("fs"),w=require("path");t=__dirname+"/";v=a=>{a=x(a)?new URL(a):w.normalize(a);return fs.readFileSync(a)};u=a=>{a=x(a)?new URL(a):w.normalize(a);return new Promise((b,d)=>{fs.readFile(a,void 0,(e,n)=>{e?d(e):b(n.buffer)})})};process.argv.slice(2);"undefined"!=typeof module&&(module.exports=c);r=(a,b)=>{process.exitCode=a;throw b;}}else if(aa||h)h?t=self.location.href:"undefined"!=typeof document&&document.currentScript&&(t=document.currentScript.src),t=t.startsWith("blob:")?"": +t.substr(0,t.replace(/[?#].*/,"").lastIndexOf("/")+1),h&&(v=a=>{var b=new XMLHttpRequest;b.open("GET",a,!1);b.responseType="arraybuffer";b.send(null);return new Uint8Array(b.response)}),u=a=>x(a)?new Promise((b,d)=>{var e=new XMLHttpRequest;e.open("GET",a,!0);e.responseType="arraybuffer";e.onload=()=>{200==e.status||0==e.status&&e.response?b(e.response):d(e.status)};e.onerror=d;e.send(null)}):fetch(a,{credentials:"same-origin"}).then(b=>b.ok?b.arrayBuffer():Promise.reject(Error(b.status+" : "+b.url))); +var ba=c.print||console.log.bind(console),y=c.printErr||console.error.bind(console);Object.assign(c,p);p=null;var z=c.wasmBinary,A,B=!1,C,D,E=[],F=[],ca=[],J=[];function da(){var a=c.preRun;a&&("function"==typeof a&&(a=[a]),a.forEach(ea));K(E)}function ea(a){E.unshift(a)}function fa(a){J.unshift(a)}var L=0,M=null,N=null,O=a=>a.startsWith("data:application/octet-stream;base64,"),x=a=>a.startsWith("file://"),P; +function Q(a){if(a==P&&z)return new Uint8Array(z);if(v)return v(a);throw"both async and sync fetching of the wasm failed";}function ha(a){return z?Promise.resolve().then(()=>Q(a)):u(a).then(b=>new Uint8Array(b),()=>Q(a))}function R(a,b,d){return ha(a).then(e=>WebAssembly.instantiate(e,b)).then(d,e=>{y(`failed to asynchronously prepare wasm: ${e}`);c.onAbort?.(e);e="Aborted("+e+")";y(e);B=!0;throw new WebAssembly.RuntimeError(e+". Build with -sASSERTIONS for more info.");})} +function ia(a,b){var d=P;z||"function"!=typeof WebAssembly.instantiateStreaming||O(d)||x(d)||l||"function"!=typeof fetch?R(d,a,b):fetch(d,{credentials:"same-origin"}).then(e=>WebAssembly.instantiateStreaming(e,a).then(b,function(n){y(`wasm streaming compile failed: ${n}`);y("falling back to ArrayBuffer instantiation");return R(d,a,b)}))}function S(a){this.name="ExitStatus";this.message=`Program terminated with exit(${a})`;this.status=a} +var K=a=>{a.forEach(b=>b(c))},ja=c.noExitRuntime||!0,ka=[null,[],[]],T="undefined"!=typeof TextDecoder?new TextDecoder:void 0,la={a:(a,b,d,e)=>{for(var n=0,W=0;W>2],X=D[b+4>>2];b+=8;for(var G=0;G=m);)++q;if(16g?m+=String.fromCharCode(g):(g-=65536,m+=String.fromCharCode(55296|g>>10,56320|g&1023))}}else m+=String.fromCharCode(g)}f=m}(1===a?ba:y)(f);H.length=0}else H.push(f)}n+=X}D[e>>2]=n;return 0}},U=function(){function a(d){U=d.exports;A=U.b;d=A.buffer;c.HEAP8=new Int8Array(d);c.HEAP16=new Int16Array(d);c.HEAPU8=C=new Uint8Array(d);c.HEAPU16=new Uint16Array(d);c.HEAP32=new Int32Array(d);c.HEAPU32=D=new Uint32Array(d);c.HEAPF32=new Float32Array(d); +c.HEAPF64=new Float64Array(d);F.unshift(U.c);L--;c.monitorRunDependencies?.(L);0==L&&(null!==M&&(clearInterval(M),M=null),N&&(d=N,N=null,d()));return U}var b={a:la};L++;c.monitorRunDependencies?.(L);if(c.instantiateWasm)try{return c.instantiateWasm(b,a)}catch(d){return y(`Module.instantiateWasm callback failed with error: ${d}`),!1}P??=O("test_emsize.wasm")?"test_emsize.wasm":c.locateFile?c.locateFile("test_emsize.wasm",t):t+"test_emsize.wasm";ia(b,function(d){a(d.instance)});return{}}(),V=c._main= +(a,b)=>(V=c._main=U.d)(a,b),Z,ma;N=function na(){Z||pa();Z||(N=na)};function pa(){function a(){if(!Z&&(Z=1,c.calledRun=1,!B)){K(F);K(ca);c.onRuntimeInitialized?.();if(qa){var b=V;try{var d=b(0,0);ja||(c.onExit?.(d),B=!0);r(d,new S(d))}catch(e){e instanceof S||"unwind"==e||r(1,e)}}if(b=c.postRun)"function"==typeof b&&(b=[b]),b.forEach(fa);K(J)}}if(!(0{setTimeout(()=>c.setStatus(""),1);a()},1)):a()}} +if(c.preInit)for("function"==typeof c.preInit&&(c.preInit=[c.preInit]);0fh4hbZxLqZg{NFj;%i3Ea#>>x-$f(nO-4+s(^ z1w{%93JN+X_y8&@3JQ7}{s7+CM^HH3?bvU3-^{$3Iof)3pNWVs7MrH)I_@@E7mH`L zM4JR-x@R3f+Z4s5VBX>_5;Jm!*=9^RmWOO@mNOs7f#eP(>HSOVizUmqh4>CJZCPERd_2{$#HSzsJ(qDkCdCQ1uyRv~U9mpm5l=UjZu z6(#USDS-mFH4Tny8M6mZZ4yX*plIz3+!72(uMq`F+|+ngV}ex&wj|IWxq%{3gG`kb z=X?-x@? z)mI{K>4q+N`YK#>=Rws*bAf^hG?A5Pr&8(D={f@>Q(1xGshow$f`v#^IUP7iqX$ye z)SRR)1eF>DpU8Ensd0E>>`RpctL}#ma+^%P~&F41^>Vi=O7h2KG_D{wtw)#^_fPry6mO>=LavI z?hXbqsH_YM^w2Sb2EXrG9}%_8!x_}3%JjKa#z*cm&`j4#lG%Jt7Jv@z3DSP_2A~gB zmBzrJyTO9isoF?rogP}$^8Y`qa&lPJNUcUs^Of2p605Z~hV^LX~H6SyQW2 zX*953&oxh9-n+ZA^Wai=@?dXg8;Tt|&l#oHFsy$F{*(}r!SAibg697+Y<+h=`;E`S EAMM<@G5`Po literal 1781 zcmaJ?&2Ah;5U#53*`3|q@lMbpS&k)o1|KZpNR|=}k>$fSlI=Kl@R^$pNrYyM!rDmT zfIJK00XTrf1MmPm075?U09-ip7zn~w-A?$Cz>>$+)zx2Def?FL&MrS$Wvv^+?!hVa9Bd$)&}A29ilKkC3#r1-eBwlwJ%mPQTkiZW#u968OCi!12D*;&`1N7{Wrpaxkv~gRD zHz$!8vjA;MvI(CpY6{nM2%ZI4^R~7}1tkd7iv$z1wn2fBbYy)nu(JA<^d>@yXg~WFuLdjcg`stC6i_Z8x%=tb2{zOV<5H?k8)vkzEuv?_y!| z4u#oAS`oGh75*c84mJ^Bl>jZ&DQzZL72XYr-~ojvExzRSUqnVqd56HIk}EqT$uc`+ zkj>w3d6kX99slRJS*JaxccN9$I*6&+5B;F4HL;uf z<7=7FtAcFk4+>SX9{cb1@i%gZCedE#I0I7j2WMYDE!K8Jk zY~oB}6wc6md@ns+W29W7L04^)mo1eFud2e;#7lZbZ|#zrNu)uEcM12YNV z{Dlv=X&Yh^I)?*8pDOn0nig4tNcR?DRDs=N=p_xSGQA6iyErXiU)>m9>;_bhQNAH| z?$JO=bgzB*